Authentication bypass in Keeper K5 HD Network Camera
| Risk | Low |
| Patch available | NO |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-16398 |
| CWE-ID | CWE-20 |
| Exploitation vector | Local |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software Subscribe |
Keeper K5 Hardware solutions / Security hardware applicances |
| Vendor | Keeper |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Input validation error
EUVDB-ID: #VU21235
Risk: Low
CVSSv3.1: 6.4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C]
CVE-ID: CVE-2019-16398
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to execute arbitrary code on the target device.
The vulnerability exists due to insufficient validation of user-supplied input. An attacker with physical access to the device can insert an SD card containing a file named "zskj_script_run.sh" that executes arbitrary code.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsKeeper K5: 20.1.0.25 - 20.1.0.63
External linkshttp://gitlab.com/crypt0crc/cve-2019-16398
http://www.youtube.com/watch?v=S_cTme7m8Ng&feature=youtu.be
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
